CVE-2016-3729: CSRF

Published May 13, 2016
·
Updated

Multiple vulnerabilities were fixed in moodle 3.0.4, 2.9.6, 2.8.12 and 2.7.14 releases.

============================================================================== MSA-16-0013: Users are able to change profile fields that were locked by the administrator

Description: User editing form only disabled the profile fields in UI and did not actually prevent users from editing them Issue summary: Tricky users can change locked profile fields Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Vadim Dvorovenko Issue no.: MDL-53954 CVE identifier: CVE-2016-3729 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53954

============================================================================== MSA-16-0015: Information disclosure of hidden forum names and sub-names.

Description: Name of the inaccessible forum or forum discussion could be disclosed as part of the error message on the subscription page Issue summary: Information disclosure of hidden forum names and sub-names. Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5 and 2.8 to 2.8.11 Versions fixed: 3.0.4, 2.9.6 and 2.8.12 Reported by: Callum Issue no.: MDL-53696 CVE identifier: CVE-2016-3731 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53696

============================================================================== MSA-16-0016: User can view badges of other users without proper permissions

Description: Capability check to view other badges was performed for the current user instead for the user whose badges are being viewed Issue summary: Badges code checks viewotherbadges capability in the wrong context Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6 and 2.8.12 Reported by: Tim Hunt Issue no.: MDL-53589 CVE identifier: CVE-2016-3732 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53589

============================================================================== MSA-16-0017: Course idnumber not protected from teacher restore

Description: During the course restore teacher could overwrite idnumber even without having the capability to change it Issue summary: Course idnumber not protected from teacher restore Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Donna Hrynkiw Issue no.: MDL-51369 CVE identifier: CVE-2016-3733 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369

============================================================================== MSA-16-0018: CSRF in script marking forum posts as read

Description: CSRF possible in the URL that marks forum posts as read Issue summary: Forum markposts.php missing sesskey check Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Andrew Nicols Issue no.: MDL-53755 CVE identifier: CVE-2016-3734 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755

==============================================================================

Other sources

The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.

GitHub

Affected Software

52 affected componentsFixes available
redhat/moodle<3.0.4
3.0.4
redhat/moodle<2.9.6
2.9.6
redhat/moodle<2.8.12
2.8.12
redhat/moodle<2.7.14
2.7.14
composer/moodle/moodle>=2.7<2.7.14
2.7.14
composer/moodle/moodle>=2.8<2.8.12
2.8.12
composer/moodle/moodle>=2.9<2.9.6
2.9.6
composer/moodle/moodle>=3.0<3.0.3
3.0.3
Moodle moodle=2.7.0
Moodle moodle=2.7.0-beta
Moodle moodle=2.7.0-rc1
Moodle moodle=2.7.0-rc2
Moodle moodle=2.7.1
Moodle moodle=2.7.2
Moodle moodle=2.7.3
Moodle moodle=2.7.4
Moodle moodle=2.7.5
Moodle moodle=2.7.6
Moodle moodle=2.7.7
Moodle moodle=2.7.8
Moodle moodle=2.7.9
Moodle moodle=2.7.10
Moodle moodle=2.7.11
Moodle moodle=2.7.12
Moodle moodle=2.7.13
Moodle moodle=2.8.0
Moodle moodle=2.8.1
Moodle moodle=2.8.2
Moodle moodle=2.8.3
Moodle moodle=2.8.4
Moodle moodle=2.8.5
Moodle moodle=2.8.6
Moodle moodle=2.8.7
Moodle moodle=2.8.8
Moodle moodle=2.8.9
Moodle moodle=2.8.10
Moodle moodle=2.8.11
Moodle moodle=2.9.0
Moodle moodle=2.9.1
Moodle moodle=2.9.2
Moodle moodle=2.9.3
Moodle moodle=2.9.4
Moodle moodle=2.9.5
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3

Event History

Apr 20, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:12 AM

Frequently Asked Questions

1

What versions of Moodle are affected by CVE-2016-3729?

CVE-2016-3729 affects Moodle versions 2.7.0 to 2.7.13, 2.8.0 to 2.8.12, 2.9.0 to 2.9.6, and 3.0.0 to 3.0.3.

2

What is the severity of CVE-2016-3729?

The severity of CVE-2016-3729 is classified as high due to the risk of users altering locked profile fields.

3

How do I fix CVE-2016-3729?

To fix CVE-2016-3729, upgrade Moodle to version 2.7.14, 2.8.12, 2.9.6, or 3.0.4.

4

What type of vulnerability is represented by CVE-2016-3729?

CVE-2016-3729 is a user privilege escalation vulnerability that allows unauthorized modification of locked profile fields.

5

What should organizations do to mitigate CVE-2016-3729?

Organizations should immediately apply the recommended updates to their Moodle installations to mitigate CVE-2016-3729.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203